Sign in

v33

latestOpenAPI 3.1.0Proprietaryraw.githubusercontent.com2026-05-28103497709.6 KB
Embedded Wallet Auth

Revoke an authentication credential

Revoke an authentication credential on an Embedded Wallet internal account.

Revocation is a two-step flow because it must be authorized by a session on a different credential on the same internal account:

  1. Call DELETE /auth/credentials/{id} with no headers. The response is 202 with a payloadToSign, requestId, and expiresAt.

  2. Use the session API keypair of an existing verified credential on the same internal account — other than the one being revoked — to build an API-key stamp over payloadToSign, then retry the same DELETE request with that full stamp as the Grid-Wallet-Signature header and the requestId echoed back as the Request-Id header. The signed retry returns 204.

The account must retain at least one authentication credential; an account with only a single credential cannot use this endpoint to revoke it.

delete/auth/credentials/{id}

Path parameters

idstring required

The id of the authentication credential to revoke (the id field of the AuthMethod returned from POST /auth/credentials).

Headers

Grid-Wallet-Signaturestring

Full API-key stamp built over the prior payloadToSign with the session API keypair of an existing verified authentication credential on the same internal account (other than the one being revoked). Required on the signed retry; ignored on the initial call.

Request-Idstring

The requestId returned in a prior 202 response, echoed back exactly on the signed retry so the server can correlate it with the issued challenge. Required on the signed retry; must be paired with Grid-Wallet-Signature.

Response

Challenge issued. The response contains payloadToSign plus a requestId. Build an API-key stamp over payloadToSign with the session API keypair of an existing verified credential on the same internal account (other than the one being revoked), then echo requestId on the retry.

payloadToSignstring required

Canonical payload for the retry authorization stamp. Build an API-key stamp over this exact value with the session API keypair, then send the full base64url-encoded stamp in Grid-Wallet-Signature on the retry that completes the original request.

requestIdstring required

Grid-issued Request:<uuid> identifier for this pending request. Echo this value exactly in the Request-Id header on the signed retry so the server can correlate the retry with the issued challenge.

expiresAtstring date-time required

Timestamp after which this challenge is no longer valid. The signed retry must be submitted before this time.

type'OAUTH' | 'EMAIL_OTP' | 'PASSKEY' required

The type of authentication credential.

  • OAUTH: OpenID Connect (OIDC) token issued by an identity provider such as Google or Apple.
  • EMAIL_OTP: A one-time password delivered to the user's email address.
  • PASSKEY: A WebAuthn passkey bound to the user's device.

Example response

{
  "payloadToSign": "{\"organizationId\":\"org_2m9F...\",\"parameters\":{\"userId\":\"user_2m9F...\"},\"timestampMs\":\"1775681700000\",\"type\":\"ACTIVITY_TYPE_EXAMPLE\"}",
  "requestId": "Request:7c4a8d09-ca37-4e3e-9e0d-8c2b3e9a1f21",
  "expiresAt": "2026-04-08T15:35:00Z"
}